CVE-2026-19927: OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 is sufficient to resolve this issue. The patch is named a599007325efe780a21b3537ecce3ca25635c926. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenBoxesto a version that resolves this vulnerability.Fixed in 0.9.8-hotfix1Patch a599007325efe780a21b3537ecce3ca25635c926 - Upgrade
Upgrade
OpenBoxesto a version that resolves this vulnerability.Fixed in 0.9.8Patch a599007325efe780a21b3537ecce3ca25635c926
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19927?
CVE-2026-19927 has a medium severity rating of 6.3.
What type of vulnerability is CVE-2026-19927?
CVE-2026-19927 is classified as a server-side request forgery (SSRF) vulnerability.
How do I fix CVE-2026-19927?
To mitigate CVE-2026-19927, ensure proper validation and sanitization of the 'params.url' argument in the Upload function.
Which versions of OpenBoxes are affected by CVE-2026-19927?
OpenBoxes versions up to 0.9.7 are affected by CVE-2026-19927.
What impact can CVE-2026-19927 have on my system?
CVE-2026-19927 can potentially allow an attacker to initiate malicious requests to internal services or resources.